Vulnerability · Published Aug 12, 2026 · Assigned by WPScan

CVE-2026-18366Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

Critical 9.8

In plain English

A critical-severity privilege mismanagement in Events Manager from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 57.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Events Manager	7.1 – before 7.4.1

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/82767ce2-01e4-46ad-a52b-72d3ab2049bd/ exploit, vdb-entry, technical-description